Hexmark maps where your customers are without ever holding a name
Two columns come across: an ID and a ZIP code. Everything below is the detail a reviewer will ask for, short enough to read before the meeting it comes up in.
Connecting a customer table to a vendor puts somebody’s name on an approval.
Usually yours. And the exposure people underestimate is not a breach at a startup, it is being asked eighteen months later what exactly left the building and having to reconstruct the answer from an integration nobody wrote down.
Nothing in the schema has room for a name, a street or a date of birth. The worst case is bounded by what the product can physically hold, not by a policy someone could change later.
An ID and a ZIP code, and that is the schema
Hexmark reads an ID for each customer, a ZIP code or a set of coordinates, and optionally a city, a state, and which of your locations they belong to. You can also bring across numbers you care about, like spend or visits.
Names, street addresses, emails, phone numbers and dates of birth are not switched off or hidden behind a permission setting. The schema has nowhere to put them, which is a much stronger guarantee than a toggle somebody could flip back.
For a clinic that’s the difference between a marketing project and a legal one, and it is usually the fact that ends the security conversation rather than starting it.
Which numbers you can bring across
Totalled, counted or averaged, and nothing else. Columns whose names look identifying are refused, because a value being numeric proves nothing: ages and postal codes are numbers too.
Your data isn't reachable from anyone else's account
Every company on Hexmark gets its own separate store. A company can only read the sources we’ve explicitly authorized for it, and that list is only editable by us, not from inside the product. There’s no configuration that lets one company point Hexmark at another’s data.
Admin is a bigger deal than it sounds
Sign-in is a link to your work email. Invite only, no password to leak. An admin can change what your company connects to, so treat that role as more than an app setting. Changing it signs the person out immediately rather than at session expiry.
No phone location data ever touches your account
There is no device panel anywhere in Hexmark. With the FTC orders against location data brokers, and state bans on selling precise location now live in Maryland and Oregon, a vendor whose product does not depend on that supply chain is one fewer question in your diligence and one fewer contract to unwind later.
Hand this section to your reviewer
Everything above, stated precisely enough to check. Most vendors make this an NDA and a call.
- The customer record accepts exactly: customer_id, zip, city, state, lat, lon, location_ref, plus numeric measures. It requires an ID and either a coordinate pair or a ZIP.
- Measures are restricted to sum, count and average. A deny list refuses column names that look identifying.
- We read from BigQuery today. If your data lives elsewhere, that’s a conversation during onboarding, not a reason you cannot use Hexmark.
- Per-company datasets, an explicit source allowlist that only we can edit, and the shared reference data sits somewhere that can never be named as a source.
Send this page to your reviewer first.
That conversation goes better before a demo than after one.